Synology DSM (DiskStation Manager) Vulnerabilities & Security Advisories

15 advisories tracked · Synology Security Advisories + Synology CNA via NVD · 1 listed in the CISA Known Exploited Vulnerabilities catalog

Every row below is a published Synology advisory that VulniPulse classified as DSM (DiskStation Manager), with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 4 critical, 6 high, 5 medium.

Source

Synology Security Advisories + Synology CNA via NVD

Synology is its own CVE Numbering Authority. VulniPulse reads Synology's security advisory index for new Synology_SA_YY_NN advisories, including ones about third-party CVEs that Synology's CNA does not publish, and ingests Synology's CVEs from the NVD CNA feed ([email protected]), grouped by their advisory. Each advisory is then read from its own page — a fully server-rendered page carrying Synology's own severity rating, the affected-product / fixed-release table and the mitigation section. Covers DSM (DiskStation Manager), SRM (Router Manager), BeeStation, Synology Photos, Surveillance Station, Synology Drive and the SSL VPN Client.

Visit Synology advisories Synology RSS feed DSM (DiskStation Manager) end-of-life dates(10 dated releases)

Latest Synology DSM (DiskStation Manager) advisories

All severities critical (4)high (6)medium (5)low (0)

Critical9.8Synology

Critical [CVE-2026-76954 +1] Synology-SA-26:19 DSM

Synology has released a security update for the DSM to address multiple vulnerabilities: CVE-2026-76954 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks. Affected products named by the advisory: DSM 7.4; DSM 7.3; DSM 7.2.2; DSM 7.2.1.

High8.8Synology

High [CVE-2026-124993 +24] Synology-SA-26:18 DSM

Synology has released a security update for the DSM to address multiple vulnerabilities: Vulnerabilities allow remote attackers to read or write arbitrary files or conduct denial-of-service attacks. Affected products named by the advisory: DSM 7.4; DSM 7.3.

High7.2SynologyExploitedCISA KEV

High [CVE-2026-96652 +3] Synology-SA-26:17 Plex Media Server (Plex2Shell)

Synology has released a security update for the Plex Media Server package in DSM to address the Plex2Shell vulnerabilities. Affected products named by the advisory: Plex Media Server for DSM 7.4; Plex Media Server for DSM 7.3; Plex Media Server for DSM 7.2.2; Plex Media Server for DSM 7.2.1.

Critical9.8Synology

Critical [CVE-2026-13623 +7] improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write limited files

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write limited files. Affected products named by the advisory: DSM 7.4; DSM 7.3; DSM 7.2.2; DSM 7.2.1.

High8.0Synology

High [CVE-2026-4036 +10] improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks after the system is rebooted

An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks after the system is rebooted. Affected products named by the advisory: DSM 7.3; DSM 7.2.2; DSM 7.2.1.

Critical9.0Synology

Critical [CVE-2026-40541 +2] improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM. Affected products named by the advisory: Synology Chat Server for DSM 7.3; Synology Chat Server for DSM 7.2.2; Synology Chat Server for DSM 7.2.1.

Critical9.0Vendor: HighSynology

Critical [CVE-2026-40541] improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM

Synology has released a security update for the Synology Chat Server package in DSM to address multiple vulnerabilities: CVE-2026-40541 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks. CVE-2026-9491 allows remote authenticated users to obtain non-sensitive information. Please refer to the ' Affected products named by the advisory: Synology Chat Server for DSM 7.3; Synology Chat Server for DSM 7.2.2; Synology Chat Server for DSM 7.2.1.

Medium6.5Vendor: HighSynology

Medium [CVE-2026-9548] improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks in DSM

Medium4.3Vendor: HighSynology

Medium [CVE-2026-9491] server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information

High8.6Vendor: MediumSynology

High [CVE-2025-30028] vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files

A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files. Affected products named by the advisory: Active Backup for Business for DSM 7.2; Active Backup for Business for DSM 7.1; Active Backup for Business for DSM 6.2.

High7.5Synology

High [CVE-2025-14713] Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain user credentials from the edge server

An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain user credentials from the edge server. Affected products named by the advisory: C2. Affected products named by the advisory: C2 Identity Edge Server for DSM 7.3; C2 Identity Edge Server for DSM 7.2.2; C2 Identity Edge Server for DSM 7.2.1; C2 Identity Edge Server for DSM 7.1.

High8.1Synology

High [CVE-2025-13392] Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN)

Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN). Affected products named by the advisory: DSM 7.3; DSM 7.2.2.

Medium6.2Synology

Medium [CVE-2026-2237] use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information

A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information. Affected products named by the advisory: Storage Manager for DSM 7.3; Storage Manager for DSM 7.2.2; Storage Manager for DSM 7.2.1.

Medium5.4Synology

Medium [CVE-2025-13167] Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology Contacts before 1.0.10-20659 allows remote authenticated users to read or write specific files containing non-sensitive information via unspecified vectors

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology Contacts before 1.0.10-20659 allows remote authenticated users to read or write specific files containing non-sensitive information via unspecified vectors. Affected products named by the advisory: Synology Contacts for DSM 7.3; Synology Contacts for DSM 7.2.2; Synology Contacts for DSM 7.2.1.

Medium4.9Synology

Medium [CVE-2024-47267 +5] Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecified vectors

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecified vectors. Affected products named by the advisory: Surveillance Station for DSM 7.2; Surveillance Station for DSM 7.1; Surveillance Station for DSM 6.2.

Page 1 of 1 · showing 15 of 15

Get an email when Synology DSM (DiskStation Manager) publishes the next one.

See Synology DSM (DiskStation Manager)'s last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Synology DSM (DiskStation Manager)

iPhone and Android apps · New on the App Store

Monitor Synology DSM (DiskStation Manager) CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Get CVE alerts on Android See app features

← All Synology advisories